Unfortunately,desiging team of
www.in.com forgot to fix one of serious vulnerabilty.with help of it user's cookie can easily steal remotely or make user move for phishing(now i hope you get the point).
We hope builders of that site will read this and going to take serious action before some one will be victim with help of this vulnerability.
Due to security reasons i will not disclose this vulnerability technically.
The bug which is in the http://mail.in.com/mails/inbox.php ,called xss.There is lake of Filteration/Validation in INBOX,SENT,DELETED.(
http://mail.in.com/mails/inbox.php).In web application.
Briefing:-For Technical users:Cross Site Scripting (XSS) is an attempt to bypass input validation and give the attacker the means to inject content into the page. This content can be used to trick the user into disclosing sensitive information, execute actions via existing credentials, and so on. Even a CSRF attack can be mounted through the initial XSS hole, so in some ways, XSS is an exploit with nearly limitless possibilities. Unfortunately, XSS is also extremely common, arguably the biggest bane of web applications, affecting both large and small sites.
For the common userswho dont know anything about technical web building and security. Xss can define as
Defenation:Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users (source:wiki)
with help of this vulnerability computer hacker can make following harm to user/organization :
* * Identity theft
* * Accessing sensitive or restricted information
* * Gaining free access to otherwise paid for content
* * Spying on user's web browsing habits
* * Public defamation of an individual or corporation
* * Web application defacement
Solution:-
Preventing Cross Site Scripting attacks
To prevent these attacks, dangerous characters must be filtered out from the web application inputs. These should be filtered out both in their ASCII and HEX values.
Note:-
This article only to make users aware about computer security.and for people can save their self from damage. Do not use this article to harm anyone.(I will not responsible for anything)Subscribe to feeds for more update on this.
Labels: bug, security
